Huntress: ClickFix chains now persist, move laterally, and steal credentials
Recent lures use malvertising, typosquats, and compromised sites, then show fake verification text while payloads run.
Stories per day · 30 days
1 RSS
Relatedarch-linux2armorsteal2aur2infostealer2linux2malware2pyarmor2supply-chain2chocolatey1clickfix1malvertising1paru1powershell1python1search-poisoning1seo-poisoning1social-engineering1yay1
14 stories, newest first · one card per story
Stories tagged #typosquatting
Fake Chocolatey and Microsoft activation sites distribute ArmorSteal
Zscaler says the September campaign's Python malware also logs keystrokes, swaps wallet addresses, and checks C2 every 60 seconds.
4
SEO poisoning campaign delivers new Armorsteal malware
Fake Chocolatey and Massgrave sites installed a Python remote-access module that steals system data and runs signed tasks.
1
Fake Arch Linux AUR packages exploit typos to run malware with root privileges
Typosquatted Arch Linux AUR packages impersonating yay and paru could run downloaded code as root.
3
Fake Arch Linux packages push malware with root privileges
Typosquatted Arch User Repository packages impersonating yay and paru ran a remote shell as root.
5
Two characters open up a world of typosquatting opportunities in Chromium browsers
Researchers demonstrate Cyrillic barred-o and Latin k-hook glyphs bypass Chromium's anti-spoofing checks, letting lookalike domains like fake Apple and Okta render as genuine.
4
Hackers Use Fake ChatGPT, Claude and Gemini Ads to Steal Passwords and MFA Codes
Attackers use fake ChatGPT, Claude, and Gemini ad sites to steal passwords and MFA codes.
4
Fake Express Packages on npm Spread a Linux Worm
Nine fake Express and React npm packages install a Linux worm deploying a CHAOS RAT backdoor that spreads via SSH keys and npm tokens.
2
670 Jev Domains Registered After Launch as Fake AI Marketplaces Target Users
About 670 lookalike Jev domains appeared days after launch, with fake shops marking up API access.
5
Malicious npm packages evade install-script defenses at runtime
Malicious npm package 'indexed-btree' hides a loader in runtime code to evade install-script defenses, reaching 2 million weekly downloads alongside nine related packages.
Claimed Bug Bounty Hunter Likely Used LLM to Build PhantomRaven npm Stealer
CrowdStrike ties the PhantomRaven npm infostealer, active since 2022, to a self-described bug bounty hunter who likely wrote it with an LLM.
3
Search results are sending people to fake Bitrefill checkouts
Scam sites impersonating Bitrefill's crypto checkout appear in search results, tricking victims into sending up to $1,990 in crypto directly to scammers.
1
Fake bank websites play dead to evade security scanners
Fortra uncovered Chameleon SEO Poisoning: cloaked typosquat bank sites rank on Google and Bing to steal credentials while evading scanners, with cases up 40% in Q2 2026.
16 Typosquatted RubyGems Packages Steal Browser Credentials and Crypto Wallets
Typosquatted RubyGems packages deliver the StubMaker infostealer, stealing browser credentials, crypto wallets, and Telegram data from Windows developers.
3